{"record":{"id":"ad34ca4eebedbd1b","repo":"fatedier/frp","slug":"invalid-auth-tokensource-v","errorCode":null,"errorMessage":"invalid auth.tokenSource: %v","messagePattern":"invalid auth\\.tokenSource: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/v1/validation/auth.go","lineNumber":40,"sourceCode":")\n\nfunc (v *ConfigValidator) validateAuthTokenSource(token string, tokenSource *v1.ValueSource) error {\n\tvar errs error\n\t// Preserve the previous client/server validation order for joined errors.\n\tif token != \"\" && tokenSource != nil {\n\t\terrs = AppendError(errs, fmt.Errorf(\"cannot specify both auth.token and auth.tokenSource\"))\n\t}\n\tif tokenSource == nil {\n\t\treturn errs\n\t}\n\n\tif tokenSource.Type == \"exec\" {\n\t\tif err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {\n\t\t\terrs = AppendError(errs, err)\n\t\t}\n\t}\n\tif err := tokenSource.Validate(); err != nil {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid auth.tokenSource: %v\", err))\n\t}\n\treturn errs\n}\n","sourceCodeStart":22,"sourceCodeEnd":44,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/config/v1/validation/auth.go#L22-L44","documentation":"validateAuthTokenSource delegates to ValueSource.Validate() to check the tokenSource structure itself; any failure is wrapped as 'invalid auth.tokenSource'. This fires only when tokenSource is non-nil (and after the exec-type unsafe-feature check), so the wrapped error describes a malformed token source definition — unsupported type, missing required fields like path/command, or a bad combination of fields.","triggerScenarios":"Config validation with a tokenSource whose type is not a supported ValueSource type, or a supported type missing its required field: type=\"file\" without path, type=\"exec\" without a command. Produced whenever auth.tokenSource is present and fails its own Validate().","commonSituations":"Typos in tokenSource type values; forgetting the path/command key when adopting secret-file or exec-based token retrieval; version differences in supported ValueSource types; also appears alongside unsafe-feature errors for type=\"exec\" when the feature is not enabled.","solutions":["Read the wrapped text after 'invalid auth.tokenSource:' — it names the exact structural problem (type or missing field).","For type=\"file\", supply a readable path; for type=\"exec\", supply the command; use only types supported by this frp version.","For type=\"exec\", also ensure the exec token source is permitted (unsafe-feature flag/policy), otherwise a companion error will persist after the structural fix."],"exampleFix":"# before\n[auth.tokenSource]\ntype = \"file\"\n\n# after\n[auth.tokenSource]\ntype = \"file\"\npath = \"/run/secrets/frp-token\"","handlingStrategy":"validation","validationCode":"// Structural pre-check mirroring ValueSource.Validate for the common types.\nfunc validTokenSource(ts *v1.ValueSource) error {\n\tif ts == nil {\n\t\treturn nil\n\t}\n\tswitch ts.Type {\n\tcase \"file\":\n\t\tif ts.Path == \"\" {\n\t\t\treturn fmt.Errorf(\"tokenSource type file requires path\")\n\t\t}\n\tcase \"exec\":\n\t\tif len(ts.Command) == 0 {\n\t\t\treturn fmt.Errorf(\"tokenSource type exec requires command\")\n\t\t}\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported tokenSource type %q\", ts.Type)\n\t}\n\treturn nil\n}","typeGuard":"func tokenSourceLooksComplete(ts *v1.ValueSource) bool {\n\tif ts == nil {\n\t\treturn true\n\t}\n\tswitch ts.Type {\n\tcase \"file\":\n\t\treturn ts.Path != \"\"\n\tcase \"exec\":\n\t\treturn len(ts.Command) > 0\n\t}\n\treturn false\n}","tryCatchPattern":"if err := validation.Validate(clientCfg); err != nil {\n\tif strings.Contains(err.Error(), \"invalid auth.tokenSource\") {\n\t\t// wrapped text names the structural problem: type or missing path/command\n\t}\n\treturn err\n}","preventionTips":["Always pair a tokenSource type with its required field (file->path, exec->command).","For type=exec, also enable the exec token-source feature flag or expect a companion unsafe-feature error.","Keep tokenSource types limited to those your frp version supports."],"tags":["go","frp","config","auth","validation","token-source"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}